GHSA-8c48-q9wj-3w37: rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

1. Summary A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent authenticated command. A real test server observed the injected DELE command. The default FTP encoding and the configuration-wizard examples include Ctl and are not vulnerable to the demonstrated filename. A manual custom encoding that omits Ctl/CrLf is mandatory and is reflected as High attack complexity. The credible trust boundary is a lower-trust source namespace feeding a more-privileged FTP destination: if the attacker already has equivalent rights on that destination, the report establishes a bug but no privilege gain. Protocol framing must still be enforced at the command sink because a filename-compatibility encoder is not a safe substitute for command-argument validation. 2. Affected Assets & Attack Surface - Verified rclone revision: a0c09f1381ae93e2a9a33c529d170186c61ad058 (v1.74.0-240-ga0c09f138) - Current-master check: the relevant paths remained present at commit 961266888fe797390c535386f3b3aa46f4853602 on 2026-07-18 - rclone FTP encoding: backend/ftp/ftp.go:232-248, 768-785 - Encoder masks/conversion: lib/encoder/encoder.go:36-68, 121-152, 1144-1165 - FTP command sinks: backend/ftp/ftp.go:1071-1173, 1309-1428 - Dependency: github.com/jlaffaye/ftp@v0.2.1-0.20251026020404-6602e981a1bb - Dependency command formatting: ftp.go:604-610, with path-bearing callers at ftp.go:893-947, 1010-1026, and 1069-1080 - Preconditions: an attacker can create a filename in a source namespace, the victim copies/syncs it to an FTP destination with greater authority, and that destination uses a manually configured encoding that leaves CR/LF raw - Platform note: Unix and some remote backends can supply newline-bearing names; a local Windows source cannot create the demonstrated filename 3